A (protected) tweeter mentioned the existence of this issue in June 2020 without exploit details, and it seemed pretty easy for them to discover, so it's possible that other parties scraped this data as well for over a year.